Polar Oy – €122,000 Fine (Finland, 2022)

The controller is a manufacturer of heart rate monitors and smart watches offering its services in multiple Member States in the EU and wordwide. Customers (data subjects) had to register for an online service in order to use all the features of the devices, which required personal information, such as gender, height, age and weight. The device collected heart rate, max VO2 (maximum oxygen capacity) as well as BMI (body mass index) information and uploaded them to the online service. Data subjects could use the collected information to analyse training performance. The Finnish DPA received five complaints from data subjects between 22 May 2018 and 19 February 2019. The Austrian DPA received one complaint on the same matter. The complaints addressed fours main issues. First, according to the complaints, the consent to process heart rate data was forced onto the data subjects as the controller made the use of the online service conditional upon granting consent to process heart rate data. If the data subject subseqently withdrew consent, their online service account would be frozen. However, according to the controller, the device was separate from the online service as some basic features were still usable without the online service. Second, the controller also requested consent for the processing of other personal data, such as max VO2, sleep target time and daily activity target, next to information such as gender, age, height and weight. The controller argued that it was not possible to draw conclusions about a person's health based on this 'raw' data, hence there was no processing of sensitive data other than heart rate data. Allegedly, such conclusions about health would only be possible with the help of medical exminations or additional data. Third, the complaints questioned the lawfulness of data transfers to third countries. Although the controller's servers were located in the EU, in Finland and Ireland, personal data from the controller's email s